Individuals use networks such as the Internet to conduct business, communicate with others, make purchases, perform online banking, pay bills, obtain information, advertise, distribute multi-media content, etc. However, as network usage increases, so does the risk of fraud and theft. Unwary network users run the risk of being misrepresented, having their identities or credit card information stolen, having their accounts infiltrated, and/or having their personal information exposed. Criminals are often able to fraudulently obtain such information by using a man-in-the-middle (MITM) process or other attack.
A MITM attack generally refers to where an attacker becomes a network interloper making it possible to read, insert, and/or modify messages sent between two parties without either party knowing that the link between them has been compromised. In addition, attackers often use a phishing site alone or in conjunction with a MITM attack. A phishing site can be a website created by the attacker and which appears to be a genuine banking website, credit card website, etc. Thinking it is a legitimate website, a user enters his/her account authentication information, thereby providing it to the attacker. Attackers can also use chosen-ciphertext attacks (CCA), denial of service attacks, replay attacks, substitution attacks, etc.
Common defenses to MITM and other attacks include the use of encryption, implementation of secure routing practices, using secured connections, and/or using secure authentication protocols such as secure sockets layer (SSL) or transmission layer security (TLS). In addition, many websites are now attempting to increase security by displaying a predetermined image, phrase, stamp, or other indicator to the user. On such websites, the user is required to select or provide the indicator during an enrollment process. The indicator is generally in the form of a jpeg file, bitmap file, or other commonly used image file. In subsequent authentication attempts, the user can be asked to enter his/her user ID. If the user ID is validated, the user can be presented with the indicator that he/she selected during enrollment. If the user sees the correct indicator the user can enter his/her password and complete authentication. If the user does not see the correct indicator the user can be alerted that he/she may be on a phishing site.
While the above-described authentication system provides some security, it does not protect against all attacks. For example, an attacker can still insert his/herself between a user and a legitimate website equipped with the authentication technique, establish a secure connection with the user, and establish a secure connection with the legitimate website. The attacker can also create a convincing phishing site which mimics the legitimate website. The attacker can present the phishing site to the user, receive authentication information from the user, and enter the authentication information into the legitimate website using the secure connection that he/she has established with the legitimate website. The attacker can then receive the indicator associated with the user. The attacker can, in real time, copy or otherwise recreate the indicator and present it to the user. The attacker is able to do this in part because of the form of the indicator and the way in which it is rendered. Current authentication systems do not ensure that the indicator can only be rendered on one device. In addition, current authentication systems cannot effectively encrypt or otherwise protect a jpeg file, bitmap file, or other commonly used image file to prevent the attacker from implementing a real time duplication. Thus, the attacker can convince the user that the user is on a genuine website and obtain all of the user's authentication information. Once the attacker has stolen the authentication information, the attacker can plug the user into the legitimate website such that the user is unaware of the theft. This is an example of just one attack. There are many variations of this and other attacks which can be used to exploit an indicator-based authentication system. Further, the above-described indicator-based authentication system does not provide mutual authentication. Simply displaying an indicator for the user to view does not require any action on the part of the user. Thus, while the use of an indicator can help prove to the user that a website is genuine, the indicator does help prove to the website that the user is genuine.
Another authentication system used by websites can also require a user to select an image, phrase, stamp, or other indicator during an enrollment process. The selected indicator is then displayed to the user each time the user accesses the website from his/her computer and prior to the entry of any authentication information by the user. To accomplish this, the system links the selected indicator to the user's computer. Because of the link, this system is limited in that it requires users to always authenticate from the same computer. The system is also limited because it does not allow multiple users to authenticate from the same computer. Further, the mere presentation of an indicator does not provide mutual authentication. Another authentication system requires users to answer one or more security questions during an enrollment process. During subsequent authentication attempts, the user is again required to answer the one or more security questions to verify the user's identity. However, as described above with reference to an indicator, the questions can easily be reproduced and presented to the user through a phishing site by an attacker.
Thus, there is a need for an authentication system which provides mutual authentication and which is effective against man-in-the-middle attacks and other such attacks. Further, there is a need for an authentication system which utilizes an indicator which cannot be duplicated or recreated in real time. Further yet, there is a need for an authentication system in which the indicator can only be properly rendered on one device. Further yet, there is a need for an authentication system in which the indicator is a fractal image corresponding to a fractal equation.